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CHIP SHIELDING SYSTEM AND METHOD 
FIELD OF THE IN VENTION 
The present invention relates to protecting integrated circuit chips 
from invasive attack through the use of a shield. 

5 

BACKGROUND OF THE INVENTION 
Security chips are of use to those wanting to protect information, 
data transmissions or value (typically monetary). These security chips protect data 
by storing it in secure memory or transmit data securely through the use of 

10 cryptography implemented on chip. There are many reasons for using these 
products including secure banking cards, secure access systems and secure 
personal identity systems. It is known in the art to protect these chips from 
invasive attacks whereby criminals and other agents attack the card to try to 
obtain, change or use secret information on the card, 

15 One type of attack involves trying to place contacts onto internal 

chip nodes in order to read internal data traffic. This may be achieved by probing, 
using fine needles to break through the surface passivation to reach the fine metal 
tracks. Alternatively focused ion beam (FIB) may be used to deposit pads of metal 
onto the tracks for subsequent probing or bonding by wires. However it is 

20 achieved, measuring the signals on internal chip nodes represents an attack, and if 
successful this attack may render the chip and entire system on which it is based, 
insecure. 

Shields to protect a chip from the above attacks exist at present; 
they are typically divided into two categories, active and passive. Passive shields 

25 are simple metal layers over all or part of the circuit and are designed to prevent 
viewing and probing. Passive shields may be removed by chemical, plasma or 
other techniques without changing the operation of the circuit. In other words, a 
passive shield works to deter attackers by making viewing more difficult initially, 
but will not actively defend itself against removal. 

30 Active shields may look similar or may look more like a network of 

lines covering all or part of a circuit. If a line or part of the shield is removed. 
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severed or short-circuited to another line, the breach is detected and the chip halts 
some or all functions. 

Active shields may still be breached using, for example, the 
following technique. An active shield line is identified as above the circuit element 
5 to be attacked. The shield line is bypassed using the ability of the FIB system 
previously mentioned. The bypass is in the form of a diversion track added in 
parallel to the original shield track. The original shield track may now be removed 
leaving the new bypass to fool the detection circuit. No circuit break is detected. 

The following references are believed to represent the state of the 

10 art: 

US Patent No. 4,583,01 1 to Pechar; 

US Patent No. 4,766,516 to Ozdemir et al; 

US Patent No. 4,920,402 to Nakaya et al; 

US Patent No. 5,336,624 to Walden; 
15 US Patent No. 5,468,990 to Daum; 

US Patent No. 5,783,846 to Baukus et al; 

US Patent No. 5,866,933 to Baukus et al; 

US Patent No. 5,821 ,582 to Daum; 

US Patent No. 5,824,571 to Rollender et al; 
20 US Patent No. 5,930,(563 to Baukus et al; 

US Patent No. 5,973,375 to Baukus et al; 

US Patent No. 6,064, 1 1 0 to Baukus et al; 

US Patent No- 6,1 17,762 to Baukus et al; 

US Patent No. 6,294,816 to Baukus et al; 
25 US Patent No. 6,360,321 to Gressel et al; 

US Patent No. 6,613,661 to Baukus et al; 

US Patent No. 6,720,656 to Matsumoto; 

US Patent Application Publication No. 07/923,41 1 of Baukus et al; 
US Patent Application Publication No. 2001/0033012 of 
30 Koemmerling et al; 

US Patent Application Publication No. 2002/0173131 of Clark JR et 

al; 
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PCT Published Patent Application WO 91l29S(n of Fortress U & T 

Ltd.; 

PCT Published Patent Application WO 01/50530 of Koemmerling et 

al; 

5 PCT Published Patent Application WO 01/54194 of NDS Limited; 

EP Published Patent Application No. EP 0 585 601 of Hughes 
Electronics Corporation; 

EP Published Patent Application No. EP 0 940 851 of Hughes 
Electronics Corporation; and 
10 '""Infineon Introduces Chip Card Controllers for Improved Security 

of Electronic Identity Cards and Passports'\ available on the World Wide Web at 
www.in£ineonxom/cgi/ecrm.dll/jsp/showfrontend.do?lang==EN&BV_SessionID== 
@@@@0590998578. 1 1 09855404@@@@&BV JBngineID=ccchadddmlfiddkcflg 
cegndfifdfoh.O&content_type=NEWS&content_pid= 1 07623&news_nav_oid=- 
15 9979. 

The disclosures of all references mentioned above and throughout 
the present specification, as well as the disclosures of all references mentioned in 
those references, are hereby incorporated herein by reference. 
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SUMMARY OF THE INVENTION 
The present invention, in preferred embodiments thereof, comprises 
an active shield made in such a way that individual tracks are not visible by any 
normal microscopy technique. The tracks are preferably present in a layer of 
5 semiconductor material. The tracks preferably comprise doped regions separated 
by semi-insulating regions of either undoped material, or differently doped 
material. The tracks are doped sufficiently to allow conduction of electronic 
carriers. Between the tracks, the material, doped or undoped, is depleted of 
carriers. This region is rendered semi-insulating through the lack of intrinsic or 
10 extrinsic carriers, or through the trapping of such carriers. The conductive region 
is formed into tracks which forai part of an active shield as described above. Most 
preferably, the conductive lines and the insulating regions between them are made 
in the same way and look identical to all analytical techniques. An attacker 
therefore does not know where to bypass thp active shield lines. 
15 Preferably the path of the conductive tracks is randomized for each 

shielded chip produced. The randomization helps prevent attackers from 
characterizing a device destructively to find the shield path, and then applying the 
information gained to a pristine device. Shield breach detection circuitry is 
preferably added to the circuitry of the chip, so that when a breach in the active 
20 shield is detected, the detection initiates a "breach detected" mode designed to 
protect the chip from reverse-engineering, as is well-known in the art. 
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BRIEF DESCRIPTION OF THE DRAWINGS 
The present invention will be understood and appreciated nipre fully 
from the following detailed description, taken in conjunction with the drawings in 
which: 

Fig. 1 is a simplified pictorial illustration of an integrated circuit 
protected by chip shielding, constructed and operative in accordance with a 
preferred embodiment of the present invention; and 

Fig. 2 is a simplified pictorial illustration of a top view of the 

integrated circuit of Fig. 1. 
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DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS 

The present invention, in preferred embodiments thereof, provides 
a method to protect a security chip from invasive attacks. Preferably, a layer is 
added above the layers of the circuit to be protected from attack. The added layer 
5 may be made of polycrystailine silicon, as this material is commonly used in the 
manufacturing cycle of integrated circuits, but may alternatively be made of many 
other suitable materials. Any material whose conductivity can be materially 
changed without being visibly different would be a candidate for the material to be 
used in the added layer. The added layer is typically applied towards the end of the 
10 chip manufacturing process, and is applied above the normal circuit interconnect 
layers. The added layer may also be protected by a passivation layer, as is 
typically used in such integrated circuits. 

The added layer is preferably implanted with dopants to allow 

conduction. , 

15 In a first preferred embodiment of the present invention, dopants are 

selectively implanted in tracks corresponding to where the designer wants them 
placed, as follows: 

- A layer of photo-resist is placed on top of the newly added 
layer, and the desired pattern of tracks is created in the photo-resist by any 

20 appropriate method, such methods being well-known in the art. 

- The photo-resist is developed, leaving the desired track 
pattern bare, with the rest of the wafer being still covered by photo-resist. 

- Dopants may then be implanted in the material by high 
energy ion bombardment or by any other appropriate method. Dopants are thus 

25 implanted in the desired pattern of tracks (and also, incidentally, in the photo- 
resist). 

- The photo-resist is then removed from the wafer, leaving 
the dopants selectively implanted in the desired pattern of tracks. 

In a second preferred embodiment the present invention utilizes 
30 either blanket bombardment of the layer with dopant ions or incorporation of the 
dopants during the growth of the layer. The latter approach will typically be 
achieved in the case of doped polysilicon, by chemical vapor deposition (CVD) 
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growth using silane gas for silicon growth and boron trichloride gas for dopant 
species. 

However the growth and dopant incorporation is achieved, it must 
be done in such a way that the incorporated dopant atoms are not active. This 
means that the dopant atoms are not on designated sites as substitutes for the main 
material atoms. This means that the dopant atoms are interstitial, or between their 
normal, substitutional sites. This further means that the dopant atoms do not 
contribute carriers to conduction processes in the layer. This means that the 
material, as grown, is semi-insulating and does not conduct. 

A further step in the creation of the shield layer is the activation of 
the dopants described above. The activation is typically achieved through an 
annealing process. This annealing process is effective if the material is heated to a 
temperature close to (typically, within approximately 100 degrees C of) its melting 
point. 

In the first preferred embodiment described above, annealing of the 
entire wafer (blanket annealing) will cause the implanted tracks to become 
conductive; such blanket annealing may be carried out using any appropriate 
method known in the art. 

In certain preferred embodiments of tiie present invention, the 
doped polysilicon is rapidly brought up to the annealing temperature by irradiation 
from a pulsed light source. The pulsed light source may be an infrared laser. The 
laser may be a YAG laser (Yttrium Aluminum Garnet, output wavelength 1064 
nm). This laser may be driven in pulsed mode with a q-switch to limit the on-time 
to several nanoseconds or faster. The high power density during the pulse must be 
sufficient to anneal the dopants in that region of the material. In addition, the 
power density during the pulse must not be sufficient to ablate the material or 
cause damage to active circuit layers. Such laser annealing is preferred in the 
second preferred embodiment described above. 

In the second preferred embodiment described above, conductive 
tracks are preferably patterned into the layer by the laser annealing action. The 
laser, for example, may be scanned across the surface. The pattern of scanning is 
immaterial but may be raster scanning or following the semi-random path of a 
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tracks path from start to end, or most efficiently, by alternate direction scanning 
(boustrephorous scanning) of the surface. The annealing will locally activate the 
dopants in the tracks required. 

The annealing must be such that the conductive tracks are 
5 physically similar in all important respects to the semi-insulating material between 
the tracks. An attacker cannot "see", by normal analytical means, the tracks to be 
bypassed in an attack. 

In certain preferred embodiments of the present invention, in order 
to further frustrate attackers, the path of the conductive tracks is randomized for 
10 each shielded chip produced. The randomization helps stop attackers from trying 
to characterize a device destructively to find the shield path, then applying the 
information gamed to a pristine device- The additional effort required to 
randomize the path is preferably implemented in control software and is thus 
independent of processing hardware. 
15 Randomization in this case may mean annealing to form the 

conductive tracks using straight lines and 90-degree bends (although it is 
appreciated that it is not necessary to use straight lines and 90-degree bends), but 
would be random in how the conductive path connects one contact to another. For 
example, in one chip, one may use the simplest path between two points - a 
20 straight line. In another chip the same two contacts could be joined by a longer 
series of meanders, and in other chips by different series of meanders. The point, 
as stated above, is to prevent a hacker from discovering the path of the shield in 
one device and using the path information to bypass the shield in all other devices 
of the same series of chip. 
25 Even though each chip would have the shield conductive paths in 

different patterns, the end contacts would preferably be in the same place in each 
chip, since photolithographic masks, which are difficult to change, define the 
locations of the contacts. Manufacturing many different copies of 
photolithographic masks would be extremely expensive. Therefore, the preferred 
30 track "writing" process is serial, enabling each chip to be different without 
incurring the difficulties inherent in changing the photolithographic masks. 
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Typically, the conductive paths are connected to underlying 
circuitry using conventional techniques such as tungsten plug vias, one at each end 
of each conductive path. It is also expected that, for additional security, dummy 
vias, as are known in the art, will be present but unused. The addition of dummy 
5 vias is intended to foil attempts to penetrate the shield layer based on guesses as to 
which vias may be bridged to bypass a conductive path. The creation of diversion 
tracks based on eiToneous guesses preferably initiates circuit modes that prevent 
the chip from operating correctly, as is well-known in the art. 

It is appreciated that the control software driving the track annealing 
10 process could be programmed to route the conductive tracks automatically by 
driving the laser with randomly added deviations from a simple path from one 
track end to the other track end. An alternative and pertiaps simpler technique is to 
have a lai^e but fixed number of conductive path patterns, and to make a random 
choice of which pattern to use for each chip. 
15 Reference is now made to Fig. 1, which is a simplified pictorial 

illustration of an integrated circuit protected by chip shielding, constructed and 
operative in accoixlance with a preferred embodiment of the present invention. 
This figure shows the basic construction of an integrated circuit with a silicon 
(single crystal) substrate on top of which are constructed gates and other active 
20 and passWe circuit elements interconnected by networks of (typically) aluminum 
tracks. As these aluminum fracks are vulnerable to attack a layer of polysilicon is 
shown above them to illusfrate the position of the protective shield layer. 

Reference is now made to Fig. 2, which is a simplified pictorial 
illustration of a top view of the integrated circuit of Fig. 1 . This figure shows a top 
25 down view of the protective shield layer. The serpentine track illustrates one 
method, as described above, of writing a serpentine conductive tine in this 
material. As described above, this can be achieved by scanning a pulsed infra-red 
laser over the areas to be annealed. The annealing activates the dopants in this 
region, allowing conduction along the track. The track may be connected to the 
30 underlying circuitry using, for example, tungsten plugs as vias. 

It is appreciated that various features of the invention which are, for 
clarity, described in the contexts of separate embodiments may also be provided in 
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combination in a single embodiment. Conversely, various features of the invention 
which are, for brevity, described in the context of a single embodiment may also be 
provided separately or in any suitable subcombination. 

It will be appreciated by persons skilled in the art that the present 
invention is not limited by what has been particularly shown and described 
hereinabove. Rather the scope of the invention is defined only by the claims which 
follow: 
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What is claimed is: 

CLAIMS 

1 ^ Apparatus substantially as described hereinabove. 

2, Apparatus substantially as shown in the drawings. 

3^ A method substantially as described hereinabove. 

4^ A method substantially as shown in the drawings. 
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